Abstraction of programs manipulating pointers using modal logics

1. Abstraction of programs manipulating pointersusing modal logics Yoshinori TANABE (IST & AIST) (Joint work with Yoshifumi YUASA, Toshifusa SEKIZAWA and Koichi TAKAHASHI (AIST) ) 2nd DIKU-IST Joint Workshop on Foundations of Software 21 Apr., 2006

2. Overview • Analysis of programs manipulating pointers (shape analysis) in the predicate abstraction framework. • We use formulae of modal logics as predicates. • In previous study our logic was the two-way CTL with nominals (2CTLN). It was not strong enough to verify the Schorr-Waite algorithm, which is regarded as a benchmark for this type of analysis. • In this on-going study we use a stronger logic: the alternation-free modal mu- calculus with nominals and the global modality (AFMNG). • Both safety and liveness properties are handled. The Schorr-Waite algorithm is the first mountain that any formalism for pointer aliasing should climb. —Richard Bornat

3. Logic AFMNG Schorr-Waite Algorithm Verification Method Conclusion

4. Logic AFMNG Schorr-Waite Algorithm Verification Strategy Conclusion

5. Syntax of AFMNG • AFMNG: Alternation Free Mu-calculus with Nominals and Global modality • Parameters • PC∋p: Propositional Constant • Nom∋n: Nominal • BMod∋f: Basic Modalities • Propositional Variables X ::= X1 | X2 | ... • Modalities m :: = o | f | f o: global modality • MNG φ :: = p | n | X | ￢φ | φ∨φ | <m>φ | μXφ (X is positive in φ) •  is alternation-free if it is equivallent to an NNF formula .........  X( .....  Y( .................... ).....) ... ......  Z( .....  W( .....................) .....) ...... no free occurence of X no free occurence of Z

6. Semantics of AFMNG • Semantics are given by Kripke Structure (K,R,λ), where • K: universe • R: Mod → 2K×K relation defined for each modality • λ: PC∪Nom→ 2KNominals are like predicate constants. • λ(n) is a singleton, for n∈Nom A nominal is satisfied at just one node. • R(f) = R(f) -1 f is the reverse modality of f • R(o) = K×K o expresses the global relation. • Others are same as the standard mu-calculus. • Abbreviations etc • ∧, →, [m]φ = ￢<m>￢φ, νX = ￢ X ￢ φ[￢X/X] • K, s' ² [o] ,8 s2K K,s ²independent from s' • K, s' ² <o> ,9 s2K K,s ²independent from s' • @n = [o] (n→) ≡ <o>( n ∧) for n2 Nom.  holds at the node pointed-to by n

7. nil Heap as a Kripke Structure struct Node { Node* f; Node* g; Bool b; }; Node* x,y,z; b g f x 1 0 1 z 1 y 0 PC = {b}boolean field names as PC Nom = {x,y,z }pointer variables as nominals BMod = {f,g}pointer fields as basic modalities K ² b@x b is set at node x. , nil K ² <f>b@y There is a f-parent of y where b is set. K ² (μX( y ∨ <f> X)) @ x y is f-reachable from x K ² (<g>μX( y ∨ <g> X)) @ y y is in a g-loop.

8. Logic AFMNG Schorr-Waite Algorithm Verification Method Conclusion

9. The Schorr-Waite Algorithm • Marks all nodes that are reachable from the root node in the manner of DFS. • Does not use a stack to hold the nodes for backtracking, rewrites the pointers to remember the parent node instead. root r root r ￢m m ￢m l ￢m l r r ￢m m ￢m m r r r r l l ￢m m ￢m ￢m l l

10. nil m The Schorr-Waite Algorithm root ￢m ￢m ￢m ￢m ￢m ￢m ￢m ￢m

11. The Schorr-Waite Algorithm (start) root t ￢m nil m ￢m p ￢m ￢m ￢m ￢m ￢m ￢m • conditions: • p points to nil • t points to root • every node is unmarked.

12. The Schorr-Waite Algorithm (push) root ￢s m nil m m s p ￢s m m s t m s ￢s m s m • conditions: • t is unmarked

13. The Schorr-Waite Algorithm (swing) root ￢s m nil m m s ￢s m m s p t m s s ￢s m t s m • conditions: • t is marked • p is unswung

14. The Schorr-Waite Algorithm (pop) root ￢s m nil m m s p ￢s m m s p t m s s m t s m • conditions: • t is marked • p is swung

15. The Schorr-Waite Algorithm (termination) root t s m nil m m s p m m s s m m s s m s s m • conditions: • p points to nil • t is marked

16. Logic AFMNG Schorr-Waite Algorithm Verification Method Conclusion

17. a l r c b Properties to Verify • (liveness) The algorithm terminates for any heap structure. • (safety) A node that is reachable from the root at the beginning is marked when the algorithm terminates. • (safety) The "points-to" relation at the beginning is identical to that at the end Take an arbitrary non-nil node a, which is reachable from the root at the beginning. Let b and c be the left and right child of a, resp., then at the end: • a is marked. ( ) • b and c is the left and right child of a, resp.( )

18. Predicates • a, b, c, p, t, nil, m, s, <l>b, <r>c, ... • RPp ≡reachable with "pop" relation from p • URRMS ≡ unmarked-reachable from the right child of a marked and unswung node • URUt ≡ unmarked-reachable from unmarked t s ￢s p s m ￢s ￢m t ￢m ￢m ￢m ￢m m ￢m ￢m ￢m

19. The Abstract Transition Relation for the Safety Properties (init) (init) 11 12 pushswingpop push push@a push@a 21 push@b pushswing@(￢b)pop 22 swing@b push,swing,pop 24 pushswingpop@(￢b) 23 41 pop@b swing@a swing@a 31 (none) ( end ) 42 push@c pop@a pushswing@(￢c)pop 32 swing@c 34 pushswingpop@(￢c) 33 pop@c Invariants:

20. Deciding the Abstract Transition Relation • If is satisfiable and is NOT satisfiable .... push ? swing ? wp(push, ) ∧ wp (swing, ) ∧  • AFMNG is • closed under taking weakest preconditions • decidable and has an effective decision procedure for satisfiability

21. Termination • Three ranking functions: • Use the well-founded relation "¾" on 2S. CFG start cond3 pop cond0 cond2 swing cond1push end ("non-increasing" means "decreasing or identical" ) • Using a lexicographic order, we can conclude that the algorithm terminates. • How can we judge "non-increasing" and "decreasing"?

22. Judging Non-increase and Decrease • For operation op and formula , we define • NI(op, ) = [o] ( wp(op, ) →  ) • D(op, ) = NI(op, ) ∧ <o> ( wp(op, ￢) ∧ ) • function f: S { s 2 S | S, s ² } is • non-increasing on op if NI(op, ) is valid (i.e. its negation is not satisfiable) • decreasing on op if D(op, ) is valid op Proof: Assume Spre ------->Spost . If NI(op, ) is valid, Spre² NI(op, ) holds. I.e. for any s 2 S Spre, s ² wp(op, ) )Spre, s ² Spost, s ²)Spre, s ² , which means f(Spost) µ f(Spre)

23. Logic AFMNG Schorr-Waite Algorithm Verification Method Conclusion

24. Conclusion • Analyzing programs manipulating pointers in the predicate abstraction framework using formulae of AFMNG, a modal logic, as predicates. • Both safety and liveness properties are handled. • Key issues are that the logic AFMNG is • decidable, has an effective decision procedure • closed under taking weakest preconditions for basic pointer manipulation • Ongoing activity • a detailed procedure for deciding transition relation • an experimental implementation of the decision procedure for satisfiability of AFMNG • Future work • extension of logic to handle more complicated properties / heap structure • bounded modalities • the downarrow binder • finding predicates for safety from counterexamples • finding predicates for liveness

25. Related Work • Sagiv, Reps, Wilhelm: Parametric Shape Analysis via 3-valued Logic. ACM Transactions on Programming Languages and Systems, vol 24 2002, pp.217-298. Shape analysis using abstract interpretation based on three valued logic. The logic for expressing the heap is FO+TC. The tool is called TVLA • Møller and Schwartzbach: The Pointer Assertion Logic Engine. PLDI'01. Shape analysis that employs MSO as the logic for expressing the heap properties. The tool is called PALE. • Balaban, Pnueli, Zuck: Shape Analysis by Predicate Abstraction. VMCAI 2005. Uses a decidable fragment of FO+TC as predicates. Both safety and liveness properties are handled. • John Reynolds: Separation Logic: A Logic for Shared Mutable Data Structures. LICS 2002. pp55-74. An extension of Hoare logic for pointer manipulating programs.